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Abstract. We addressed the question of optimality of private quantum channels. We 
have shown that the Shannon entropy of the classical key necessary to securely transfer 
the quantum information is lower bounded by the entropy exchange of the private 
quantum channel £ and von Neumann entropy of the ciphertext state ^3*^°-'. Based 
on these bounds we have shown that decomposition of private quantum channels into 
orthogonal unitaries (if exists) is optimizing the entropy. For non-ancillary single qubit 
PQC we have derived the optimal entropy for arbitrary set of plaintexts. In particular, 
we have shown that except when the (closure of the) set of plaintexts contains all states, 
one bit key is sufficient. We characterized and analyzed all the possible single qubit 
private quantum channels for arbitrary set of plaintexts. For the set of plaintexts 
consisting of all qubit states we have characterized all possible approximate private 
quantum channels and we have derived the relation between the security parameter 
and the corresponding minimal entropy. 
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1. Introduction 

Quantum cryptography [1, 2] (for a popular review see [3]) is a rapidly developing 
branch of quantum information processing. The results of quantum cryptography 
include quantum key distribution [4, 5], quantum secret sharing [6, 7], quantum oblivious 
transfer [8, 9] and other cryptographic protocols [10]. Quantum cryptography has two 
main goals: solutions to classical cryptographic primitives, and quantum cryptographic 
primitives. 

The first goal is to design solutions of cryptographic primitives, which achieve a 
higher (provable) degree of security than their classical counterparts. The degree of 
security should be better than the security of any known classical solution, or it should 
be of the degree that is even not achievable by using classical information theory at all. 
Another alternative is to design a solution which is more efficient (according to time, 
space or communication complexity) than any classical solution of comparable security. 



Optimality of private quantum channels 



2 



The second class of cryptosystems is motivated by the evolution of applications 
of quantum information processing, regardless whether their purpose is cryptographic, 
communication complexity based or algorithmic. These cryptosystems are designed to 
manipulate quantum information. As applications of quantum information processing 
start to challenge a number of their classical counterparts, the need to secure quantum 
communications in general is getting more urgent. Therefore, there is a large class of 
quantum primitives which should secure quantum communication in the same way as 
classical communication is secured. These primitives include encryption of quantum 
information using both classical [11, 12, 13] and quantum key [14], authentication of 
quantum information [15], secret sharing of quantum information [7, 16], quantum data 
hiding [17] and even commitment to a quantum bit [2], oblivious transfer of quantum 
information [2] and others. 

In this paper we concentrate on private quantum channels (PQC), i.e. on schemes 
for perfect encryption of quantum information using a pre-distributed classical key, 
originally introduced in [11]. Our aim is to analyze the optimal encryption of an 
arbitrary set of quantum states. In Section II we define the problem in general settings 
and investigate the elementary properties of private quantum channels including their 
optimahty. Further, in Section III we focus on PQC for arbitrary set of qubit states. We 
will restrict ourselves to encryption schemes without ancillas. The approximate private 
quantum channels (APQC) for a single qubit are investigated in Section IV. 

2. Private quantum channels and optimality 

Consider a subset V C »S(7Y) of quantum states. Its encryption is expressed by a 
completely positive tracepreserving linear map £ : B{H) — > B(7Y (8) Hanc), where TYanc 
describes some ancillary system and B{T-C) stands for the set of bounded linear operators. 
The encryption consists of two steps: i) addition of an ancilla in the state ^^^J^ and 
ii) subsequent application of the unitary transformation Uj with the probability pj 
satisfying the following identity 

s[q]^j:pMq^^^1)u]^q^'^ (1) 

for all states g E V. The triple [V,£, g^^^ satisfying Eq.(l) defines a private quantum 
channel (PQC). This definition establishes a communication quantum channel for which 
an eavesdropper gains no information by intercepting the transmitted messages. The 
indistinguishability of different convex decomposition of the same state (^^°-*) guarantees 
the security of PQC. 

The secure communication via PQC is successful only if the sender and the receiver 
share the same classical key {ji,---,jn) corresponding to the sequence of unitary 
operations {Uj^^, . . . ,Uj„). The encryption as defined in Eq.l can be viewed as a 
noisy operation S caused by the environment interacting with the system and ancilla. 
Consequently, the decryption depends on our ability to inverse such noise. Therefore, 
only unitary decompositions of PQC channels are of interest [18, 19]. The decryption 
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itself is similarly like encryption composed of two steps: i) application of a unitary 
operation according to shared classical key and ii) discarding of the ancilla. The size 
of the classical key is quantified by its Shannon entropy (H = — J2jPj log2Pi) ^^'^ 
aim is to address the question of the optimal encryption scheme that enables us securely 
communicate an arbitrary set of qubit plaintexts V. The PQC with the smaller entropy 
is better, because less amount of classical information must be distributed prior to secure 
transmission of quantum states. The authors in [11] analyzed two cases: i) encryption of 
all qubit states (optimal key H — 2), and ii) encryption of real superpositions (optimal 
key H — 1), i.e. the equatorial plane in the Bloch sphere picture. 

Before we get to a specific case of single qubit PQC let us introduce some 
important notions and properties of private quantum channels. Due to linearity the PQC 
transformation S encrypts not only the set V, but also arbitrary tracepreserving linear 
combination of its elements, i.e. the whole set Vtp = {q = J2kQkQk '■ such that Qk ^ 
'P^Y^kQk = IjQ'A: is real}. The set of operations t/j = VUj (V is unitary) forms a PQC 
[P, S', ^(0)'] (^(0)' = Vg^^^V^), providing that the quadruple [P, S, ^(o)] establishes a PQC 
for the plaintexts in V. We note that ancilla states ^^^^^ and probabilities pj remain the 
same for both 

In what follows we will restrict ourselves to PQC schemes using a fixed ancilla state, 
i-®- Ciic — ^anc for all j. Thus for PQC we have 

^[q] = J2PjUj{Q ® ^anc)C/j = g^'^ . (2) 

j 

Such restricted definition was used in the original work [11] and it is sufficient for our 
purposes, because in the next sections we will consider only PQC schemes without 
ancillas. The general case deserves a deeper investigation, but it is beyond the scope 
of this paper. Let us analyze the optimality for private quantum channels with a fixed 
state of the ancilla. 

The entropy exchange function Se^{g, £) quantifies the amount of quantum 
information lost in quantum environment due to interaction resulting in the 
transformation £ providing that the initial state of the system is q. In our case 
the state g describes the system together with the ancilla, because both of them 
are transmitted via the quantum channel together. Due to Stinespring theorem each 
quantum channel £ can be expressed as a unitary transformation on a larger system, i.e. 
£[g\ = TrenvG'(i>® |0)(0|)G't = AjgA], where G is a unitary transformation describing 
the interaction with the environment. The entropy exchange is defined as the von 
Neumann entropy of the environment state after the interaction, i.e. Sex{g, £) = S{ujcnv) 
with u;env = TV,y,tem[G'(^«) |0)(0|)Gt] = TV[A,-^4]|i) (A;| . This quantity does not 
depend on particular Kraus representation, because different Kraus representations of 
the same quantum channel are related by unitary transformation. Since PQCs are 
always random unitary channels, it follows that Wenv = J2jk ■s/PjPk^'^ \Uj gUl] \j){k\. From 
the definition of von Neumann entropy [20] as the minimum of the Shannon entropy 
over all projective measurements the following inequality holds S'(cJcnv) < 'S'(diagg[cJcnv]) 
for arbitrary state uien-v Thus, the equality is achieved if the basis B coincides with the 
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eigenbasis of the density operator cUenv The operation diag^ cancels all off-diagonal 
terms in the description of the density matrix in the basis B. In our case we have 
S'(diag[c(Jcnv]) = H{{pk})) i-e. entropy of the shared key equals to entropy of the diagonal 
elements of the state a^env Hence, we obtain the following lower bound on the key 
entropy 

H{{pk}) > max Se^{g,S) . (3) 

The left side of this inequality does depend on the particular convex decomposition 
of the quantum channel S, but the right hand side is independent of the particular 
realization of S. Therefore, the smallest possible entropy of the key H is given by the 
maximum of the entropy exchange. We have seen that this inequality is saturated only 
if the environment state is diagonal, i.e. TT[UjgUl] = for j ^ k. Choosing ~ / we 
obtain the orthogonality condition for unitary transformations Uj, i.e. TY[UjUl] ~ 
for j ^ k. Thus, convex decompositions into orthogonal unitary transformations 
saturates the above inequality. The right side is independent of the Kraus representation 
(decomposition) of £ and, moreover, for random unitary channels the maximum of S^^ 
is achieved for total mixture, because the diagonal elements are independent of the 
state g, i.e. diag[cJcnv] = diag[Ejfc VP^Tr([/j^f/^)|j)(A;|] = J2jPj\j){j\ for all states 
g. As a result we have obtained that the optimal realization of PQC minimizing the 
entropy of classical key is achieved for the encryption with mutually orthogonal unitary 
transformations. Open question is whether such orthogonal decomposition exists for all 
random unitary channels, or at least for all PQCs. 

For a mixture of pure states g — J2j Pjli^j) {i^jl the following inequality holds 
S{g) < H{{pj}). Consider a pure state l^') £ Vtp- Encryption operation £ results 
in a mixture g^°^ — with — C/j|'0), i-e. we can use the entropy of the 

state g^^^ to bound the entropy of the key from below 

H{{Pj}) > S{g^'^) . (4) 

The previous lower bound in Eq.(3) determines the optimal value of the classical key 
entropy for a given PQC £, but this bound enables us to hmit the key entropy of PQC 
based on the state g^^\ This inequality suggests that the smaller the entropy of g^^\ 
the more optimal PQC could exist. For a given set of plaintexts this means that the 
most optimal PQC should be the one with the purest possible state g^^\ However, 
this bound is not achievable in general. For instance, the encryption of all single qubit 
states requires H = 2, but the entropy of the maximally mixed single qubit state is 
= i/) = 1. 

3. Single qubit private quantum channels 

In the previous section we have shown that the optimal realization of a fixed PQC 
consists of orthogonal unitary transformations. However, the more general question is 
the optimal PQC for a given set of plaintexts V. The first question is to specify the 
states g^^^ achievable by PQC. As we have argued at the end of the previous section the 
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purer the state q^^\ the smaher could be the entropy of the classical key. Using the fact 
that arbitrary traccprcscrving linear map cannot increase the trace distance between 
two states {D[q, a) = Tx\q — a\) we obtain 

5 = mm d[q® ^anc, ^l) > D , (5) 

where N = dim(7Y(8'7ianc) is the dimension of the system together with the ancilla. This 
inequality restricts the possible states g'^'^^ to the 6 vicinity around the total mixture -^J, 
but the achievability of all such states must be proved, see below. 

3.1. Single qubit ancilla-free PQCs 

The PQC channel is a special random unitary channel, hence it is unital (preserves the 
total mixture jfl)- This feature makes it easy to analyze all PQC for a single qubit, i.e. 
for two-dimensional quantum system, if we restrict ourselves to PQC without ancillas 
(ancilla-free PQC). Under such condition the PQCs are just single qubit unital channels 
that coincide with random unitary channels, i.e. each single qubit unital channel can be 
expressed as a convex combination of unitary transformations [21]. In what follows we 
will use the Bloch sphere representation of qubit states, i.e. as a three-dimensional real 
vectors r specifying the state g = ^{I + f-a), where a = {cTx, (Ty, cr^) is the vector of Pauli 
operators. The unital quantum channels S correspond to Bloch vector transformations 
f ^ f' = Tf, where T is a 3x3 real matrix with coefficients Tj^ = TT{ajS[ak])- Each 
unital quantum channel can be written via two unitary transformations U, V and a 
specific quantum channel in the following way S[g] = U^slV"^ gV]W . The operation 
is just the convex combination of mutually orthogonal unitary transformations 
(Pauli operators I,ax,(Ty,az), i.e. ^£[g\ — J2jPj(^jQCj- In Bloch sphere representation 
this corresponds to the product of three matrices (singular value decomposition) 
T = RjjDRv, where Ru, Ry are the corresponding rotations of the Bloch sphere around 
its origin and D = diag{Ai, A2, A3} is a diagonal matrix with A^ being singular values of 
the matrix T (for details see [21, 22]). They are related to the probabilities pj via the 
following identities 

Px = i(l + Ai-A2-A3) 
Py = i(l - Ai + A2 - A3) 

P. = i(l-Ai-A2-FA3) ^ ^ 

PO = i-Px-Py-Pz- 

To guarantee the positivity the parameters Ai, A2, A3 are constrained by the inequalities 
Pj > 0. 

In the previous section we have shown that orthogonal decompositions of a given 
channel S are the optimal ones (in the sense of the key entropy). Moreover, the entropy 
of the classical keys are the same for quantum channels S and (they are unitarily 
equivalent). Therefore it is sufficient to analyze only the so-called Pauli channels for 
which the optimal realization is clearly a convex combination of Pauli unitary rotations. 
Let us start with the specification of possible sets of plaintexts Vtp- The smallest 
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possible set consists of a single plaintext {V^ = {g}), but in this case the situation is 

trivial, because there is nothing to hide. We remind us that the set of plaintexts is 

publicly known. The largest possible set contains all qubit states, i.e. = S{T-C). We 

can meet with such case whenever the set V contains four (not only three!) mutually 

independent quantum states (Bloch vectors). The mutual independence means that one 

of them cannot be written as some tracepreserving linear combination of the others. 

The tracepreserving linear combinations form a set covering the whole Bloch sphere, i.e. 

Vtp — <S(7Y). For this maximal possible set of plaintexts the optimal private quantum 

channel is represented by the completely depolarizing channel mapping all states into 

the total mixture, i.e. ^elg] = \{q + crxQCx + CyQay + azQCTz) = \l for all q. Thus a 

classical key of the length of two bits is necessary for the encryption of the whole Bloch 

sphere, i.e. H = 2 [11]. 

Our aim is to investigate the minimal length of the classical key for other possible 

sets of plaintexts V. In principle, there are only two remaining options: the set Vtp is 

generated either by two states {V2 = {^?l,^?2}), or by three states (P3 = {qi, Q2-i Qz})- 

The goal is to find the dependence of the key entropy on particular properties of these 

2 3 

generating states. In the Bloch sphere picture the sets V^^ and V^^ can be illustrated as 

hnes and planes, respectively, intersecting the Bloch sphere (for details see [22]). It is 

known [11] that for the so-called real qubits. i.e. real superpositions of two orthogonal 

pure states, only single bit is sufficient to establish a private quantum channel. Such 

states form a particular set of plaintexts consisting of all equatorial states of the Bloch 

sphere. Using this result we can conclude that there exists a private quantum channel 
2 

for arbitrary set V^^ with the entropy H = 1. This can be seen directly from the Bloch 

sphere representation, because real superpositions form a circle containing the center of 

2 

the Bloch sphere, but each line associated with V^p belongs to some plane containing 
the total mixture. Therefore, the real qubit encryption PQC scheme works for all hnes 
belonging to the corresponding real qubit plane. However, it is not known whether for 
a specific set of plaintexts (not containing the total mixture) we cannot do better and 
estabhsh a PQC with H < 1. 

3.2. All ancilla-free PQCs 

In what follows we will address the following question: which single qubit unital maps 
constitute a PQC? Except the trivial case (P^), the set Vtp contains at least two pure 
states \ip2) G Vtp. The PQC maps these two states into the state q^^\ Using the 
Bloch sphere representation this means that fi ^ r'^ = s and r2 ^ = s , where 
ri,r2 correspond to pure states, respectively, and s is associated with Using the 

explicit form of Pauli channels ($£: ^ D — diagjA^;, Xy, X^}) the identity — = 
results in the system of equations Xj{rij — r2j) — for all components j — x, y, z. This 
equalities holds only if = 0, or rij — r2j- If none of the As vanishes {X^XyX^ 7^ 0), then 
necessarily ri = ^2, i.e. the states are identical. Therefore at least one of the Xj must 
vanish. Choose A^ = 0. The complete positivity constraint [21] restricts the possible 
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values of A^^, \y so that the inequahty [A^; ± Aj^| < 1 specifies all possible (non-ancillary) 
single qubit private quantum channels, i.e. the general single qubit PQC is up to a 
unitary rotation represented in its optimal form as follows: 

^[q\ = ^((1 + + (1 + (^)(^xQ(^x + (1 - a)<7yQ<7y + (1 - b)a^ga^) (7) 

such that a — Xx — Xy,b — Xx + Xy and complete positivity constraints \a\ < l,\b\ < 1. 
The (optimal) entropy of the classical key necessary for establishing the general PQC 
channel equals 

H{S) = 2-\ Ha) + h{h)] , (8) 
where h{x) = {1 + x) log(l + x) + {1 — x) log(l — x). 

3.3. Two linearly independent states 

Consider a set of plaintexts Vxy = {Qz = + ^(^x + yo'y + ^(^z)} with x.y fixed. 
Each PQC given hj D = diag(A2:, Aj^, 0) enables us to transmit these sets securely. In 
the Bloch sphere representation these sets form lines parallel to the line connecting the 
poles of the Bloch sphere. Without loss of generality we can assume that sets Vxy are 

— 2 — 2 

the most general sets of type V^^. Indeed, arbitrary set V^p is just a unitarily rotated 
set Vxy — {Qz — ^{I + xax + ycy + za^)} for some values x,y. In particular, given 
a set V^ as a segment of the fine / crossing the Bloch sphere, it is always possible to 
choose the coordinate system in the following way: the x axis is given by the center of 
the Bloch sphere (|/) and the middle point of the segment of the line / (most mixed 
state in P^p), the y axis is perpendicular to the plane given by the whole line / and 
the total mixture. This choice of the new coordinates corresponds to a unitary rotation 
of the Pauli operators aj — >• Sj = UajW. In this basis the line is given by the states 
Qz' = |(/ + x'Sx + z'Sz) for some fixed x'. For instance, the states in Vxy can be 
transformed into this form by a suitable rotation around the z axis. Therefore, the 

2 

analysis of V^p reduces to the analysis of this type of states. Using the expression for 
the distance between an arbitrary state g f and the total mixture D{g, |7) = \r\ it 
follows that the closest state from the general set of plaintexts Vtp is always the one 
associated with the shortest Bloch vector. For the states of the form g^' the minimum is 
achieved for z' = 0, i.e. for the state ftiun = ^{I+x'Sx), for which -D(f?min) |-^) = S = \x'\. 
The solution for real qubits guarantees the existence of PQC with H = 1 and g^^^ = |/ 
(i.e. 6 = 0), but PQCs for other states g^'^^ are possible as well. Nevertheless, the 
formula for the entropy for general PQC channel guarantees that H cannot be smaller 

— 2 

than one, i.e. H > 1. Although we cannot improve the entropy rate for V^p we are 
still curious about the possibility g^^^ = ^'min- A direct calculation gives us that the 
encryption (|,7)(|,5'^) estabhshes a PQC with the desired property, i.e. 

= ]^{Qz' + S^gz'Sx) = ^(1 + x'Sx) = ^-min (9) 

with the entropy of the key H = 1. In fact, arbitrary state within the sphere 
\f\ < 6 = \x'\ is achievable with the entropy H = 1. 
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Figure 1. Optimal entropy as a function of tlic distance 6 = D{q^^\ ^I) for arbitrary 
set of plaintexts characterized by parameter S — min -^p D{g,\l). The upper line 
describes the dependence for sets of plaintexts containing three independent states 
(planes) and the lower (constant) line describes the situation for plaintexts containing 
only two independent states (lines). 



3.4- Three linearly independent states 

The sets = {Oyz = + xax + y<Jy + zaz)} for a fixed x and arbitrary y, z represent 

3 

up to unitary rotations the most general sets of plaintexts of the type P^p, i.e. planes in 

the Bloch sphere representation perpendicular to x axis. In this case not all PQC (up 

to unitary rotation) are suitable, but only those, for which = = and A^; 7^ 0. 

— 2 

This class of PQCs is more powerful, because it encrypts not only the sets P^p, but also 
3 

the sets V^^. These channels correspond to so-called phase damping channels, i.e. they 

describe the most general pure decoherence processes [23]. Using a suitably rotated 

2 3 

PQC of this form [D = diagjA^;, 0, 0}) we can encrypt any possible set V^^ and V^p 
with the entropy 

= 2 - ^[(1 + A,) log(l + A,) + (1 - A,) log(l - A,.)] . (10) 

It follows that the smallest possible value of the entropy is the same for both types 
of sets and equals H = 1, i.e. except the plaintexts containing the whole set of states 
Vtp = <S{T-C), a single bit classical key is sufficient to establish a private quantum channel 
transmitting all plaintexts g G Vtp for arbitrary set V, for which Vtp 7^ SiH). 

3. 5. Optimality 

The optimal value is achieved for A^^ = 1, i.e. the corresponding private quantum 
channels are unitarily equivalent to 

^T[q] = 1{0 + ^^.(^^^)- (11) 
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We have analyzed the achievabihty of states q^^^ ^ i-'^ sets vl-^ and the question 

— 3 

is whether the situation is similar as it was in the case of sets P^p- particular, 
^'min — \{I ^ xcr^) is the state with the smallest length of the Bloch vector among all 
states in Vx- Is it possible to design a PQC such that The answer is simple, 

because the PQC given in Eq.(ll) satisfies this property, i.e. = |(/ + xa^). 

Since all other sets V^p arc just unitarily rotated sets Vx, it follows that the states g^i^ 
arc achievable in general. For a general PQC [V^p,D = diag{A.^., 0, 0}, g^^^ the allowed 
states g^^^ are inside the sphere determined by the condition \f\ < S. In particular, 
D{g^^\ |/) = |A3,a;| = \ax\ < 5 and the entropy H is given by formula in Eq.(lO), i.e. it 
increases as the distance D{g^^\ |7) is decreasing. Denote by 9 the distance D{g'^^\ |/). 
Then for a given value of 9 the corresponding PQC transformation is D — dia,g{9/S, 0, 0}. 

As a result we have derived that the optimal entropy of the classical key for arbitrary 
(two or three dimensional) set of plaintexts equals H = 1. Moreover, wc have found 
the dependence of the optimal entropy on the distance 9 between the state g^^^ and the 
total mixture (see also Fig.l) 

H{K^O)-i (12) 
Hivl, 9)^2-^[{l + 9/5) log(l + 9/5) + (1 - 9/5) log(l - 9/5)\ . (13) 

4. Approximate private quantum channels 

Approximate private quantum channels (APQC) generalize the ideal version in the 
following sense. The quadruple [P, ^Panc, e] constitutes an e- private quantum channel 
(e-PQC), if 

D{£[gi ® g^ncl£[Q2 ® ^anc]) < 6 (14) 

for all f?2 £ v. As before, the encryption operation £ consists of a mixture of unitary 
transformations Uj applied with probabilities Pj. Similarly, the decryption operation 
is given by application of the inverse operations t/j according to a shared classical key 
represented by the sequence of unitaries f/,j, . . . , f/j„- l'^ such generalization of PQC 
the transmission is still perfect and e quantifies the security of the protocol, i.e. the 
distinguishabihty of the transferred states. 

We are not going to discuss the problem of optimality for such generalization in 
its full generality, but we will pay attention to encryption of the qubit states without 
using any additional ancillas. The set of all approximate private quantum channels is a 
specific subset of all random unitary channels determined by the value of e. As wc have 
mentioned, arbitrary single qubit unital channel can be written as a convex combination 
of unitary transformations and upto a unitary transformations the general unital qubit 
channel £ is specified by three parameters A^,, A^^, A^ related to probabilities PojPx^Py- Pz 
via the Eq.(6). The entropy achieves its optimal value (minimum) for the orthogonal 
unitary decomposotion of £, hence it equals the entropy of this probability distribution, 
H = -EjPjlogPj-. 
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It follows that each unital qubit channel establishes an e-PQC, but we still need to 
specify the particular value e and then analyze the optimal entropy as a function of the 
degree of privacy for different sets of plaintexts V. Let us analyze the case when the set 
of plaintexts V consists of all quantum states, i.e. V equals Bloch sphere. For a given 
PQC 8 (i.e. arbitrary unital channel) we have 



e= max i:>(£[^i],£[^2]) =max /^A 
ei,e-2eS(n) ri,r2 ^' 



J 

= 2max{|A^|, \\y\, |A^|} = 2Amax • (15) 

Without loss of generality we can assume that |Aa;| < \Xy\ < \Xz\ = e/2. Our aim is to 
analyze and relate the functions e = t{\x-, Xy, Xz) and H = H{\x, \y, A^). In particular 
we are interested in two questions: i) given e what is the optimal approximative PQC, 
i.e. with the minimal entropy H, and ii) given the entropy H what is the most perfect 
PQC, i.e. with the smallest e. 

Consider A^ is fixed and |Aa;| < \Xy\ < \Xz\, i.e. the security parameter e = 2|A^| is 
fixed. For unital single qubit channels the conditions of complete positivity (see Eq.(6)) 
read 

1 - A, > ± (A, - A^) 

1 + A, > ± (A, + A^) . (16) 

The values A^;, A^^, A^ satisfying these conditions form a tetrahedron with vertices 
associated with the orthogonal unitary transformations I,ax,cry,az- Since these vertices 
are unitarily related, the whole tetrahedron can be divided into four unitarily equivalent 
parts containing channels with the same values of entropy. It follows that it is sufficient 

to analyze only two regions (forming a particular single part): with strictly positive 
values {Xx, Xy, Xz > 0) and with strictly negative values {X^, Xy, Xz < 0). 

Intuitively, the geometric picture suggests that the most optimal APQC should 
shrink the Bloch sphere symmetrically, i.e. lA^^I = |Aj,| = \Xz\ = X. However, not for all 
positive, or negative combinations of X^, Xy, Xz such transformation is associated with 
some completely positive map, i.e. the probabilities pj in Eq.(6) are not positive. Let 
us assume that Aj, = A^, = A^ = A then 

Hi^2-^[{1 + 3A) log(l + 3A) + 3(1 - A) log(l - A)] . (17) 

However, the transformation is physical (and entropy makes sense) only if — | < A < 
1. Using the relation e = 2|A| we obtain the dependence of the entropy on the 
approximation (security) parameter e (see Fig. 2) for this class of channels. As we can see 
from Fig. 2 for smaller values of the security parameter e the channels given by negative 
values of A are more optimal. Indeed, one can test numerically that these points are 
optimal among all possible private quantum channels for e G [0,2/3]. Let us note that 
the point A = —1/3 corresponds to the best physical approximation of the universal 
NOT operation (given by unphysical values Aj, = A^^ = A^ = — 1). At this point the 
entropy equals H — 1.585. In the interval 2/3 < e < 0.958 the optimal entropy is 
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accuracy e 

Figure 2. The dependence of the entropy of the optimal key H for a given degree of 
secrecy e is depicted for all depolarizing channels characterized by Xx = \ = = 
X e [-1/3,1]- 

constant because the optimal depolarizing channel is still the best approximation of the 
universal NOT (A = —1/3). After that interval the entropy decreases again until its 
minimal value if = is achieved (for e = 2). 

While the depolarizing channels are optimal in the region of channels with the 
positive As for each value of e, in the negative region these channels are optimal only for 
e G [0, 2/3], because for other values the "depolarizing" channels are not physical. Let us 
remark that in the previous paragraph we have discussed the optimality for depolarizing 
channels, but for e > 2/3 these are no longer optimal. We have found numerically that 
the channels parametrized as follows A^ = —A (also for A > 1/3) and A^; = A^ = —k 
(k < A) are optimal. The inequalities (16) results in the bound k < (1 — A)/2, which 
is nontrivial only if A > 1/3. In fact, only in this case the condition n < X holds. The 
minimal entropy for A > 1/3 is achieved for k = (1 — A)/2 when 

Hn = ^[3 + \-il-\) log(l - A) - (1 + A) log(l + A)] (18) 

and e = 2A. For a given e this function should be compared with the entropy for 
depolarizing channel Hj for A > 1/3. If |A| = 0.4913 (e = 0.9826) these two function 
coincides, i.e. Hj = Hu. 

We have found that the optimal entropy for a given value of the security parameter 
is given by the following function (see Fig. 3) 

f Hi{-e) for < e < 2/3 
H = I H2{e) for 2/3 < e < 0.9826 , (19) 
[ Hi{e) for 0.9826 < e < 2 

where iii(e) = 2 - i[(l + f e) log(l - |e) + 3(1 - f ) log(l - f )] and H2{e) = 1[3 + f - 
(1 — |) log(l — |) — (1 + |) log(l + f )]. This function characterizes optimal approximate 
private quantum channels for the encryption of the whole state space. To discuss the 
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Figure 3. The optimal entropy of the key H with respect to the accuracy e for a 
single qubit aproximate private quantum channels. The optimal values are achieved 
for depolarizing channels except the interval 2/3 < e < 0.9826, when the optimal 
APQC is given by phase damping channels. 



optimality of APQC for general sets of plaintexts is beyond the scope of this paper. 
The main obstacle is that the analysis cannot be reduced to some typical sets like it 
was in the case of perfect PQC Let us note that for APQC not all the tracepreserving 
linear combination must be encrypted with the given security e. Similar result for 
approximatively private quantum channels has been derived also in Ref . [24] , where also 
the optimality for qubit was discussed using different methods and slightly different 
definition of the security parameter e. 

5. Conclusion 

For single qubits we have characterized and analyzed all possible ancilla-free private 
quantum channels and all possible approximate private quantum channels. We have 
shown that except the set of plaintexts V generating the whole set of states via 
tracepreserving linear combinations, i.e. if Vtp 7^ <S{Ti.), for arbitrary set of plaintexts 
one bit of classical key is sufficient to establish a private quantum channel. However, if 
Vtp = S (Tt) then two classical bits are necessary. In order to use single bit of key even 
in such case, one should employ an unphysical operation - universal NOT (£^not)- The 
encryption of single qubit based on the operations T, £^not (with equal probabilities) 
would map arbitrary input state into the total mixture g^^^ = ^{I[g] + ^^not[^']) = 

Except the results valid for single qubit private quantum channels we have derived 
bound on the optimal entropy for arbitrarily system. In particular we have shown that 
for PQC [P, £, g^'^^] the entropy of the key cannot be smaller than the entropy exchange 
H > maXg Se^{g, £)■ We have also shown that for a given random unitary channel 8 the 
decomposition into mutually orthogonal unitaries optimizes the entropy H. For qubits 
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such decomposition always exists, but for larger dimensional systems its existence is an 
open problem. Except extending the results to larger systems, it would be of interest to 
perform similar analysis for private quantum channels involving the usage of ancilla in 
its full generality, i.e. including ancilla. This opens a lot of new possibilities and some 
improval is very likely to happen. 
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